update core up to 2.2.1-SNAPSHOT

.drone.yml

@@ -6,6 +6,11 @@ name: build-and-deploy-dev
 # clone:
 #  disable: true
 
+host_aliases:
+  - ip: "192.168.3.49"       # ← 替换为 gitea.violin-work.online 的实际 IP
+    hostnames:
+      - gitea.violin-work.online
+
 volumes:
   - name: maven-cache
     claim:

.gitea/workflows/iam-ci.yml

@@ -1,54 +0,0 @@
-name: iam-ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    env:
-      VIOLIN_IAM_SERVICE_TOKEN_SECRET: "0011223344556677889900aabbccddeeff0011223344556677889900aabbccddeeff"
-      VIOLIN_JWT_PRIVATE_KEY_PATH: ""
-      SPRING_PROFILES_ACTIVE: dev
-
-    steps:
-      # Step 1: compile + run tests. Replaces Drone's `compile` step but does
-      # NOT skip tests — this is a CI gate on every PR.
-      - name: Compile + test violin-iam
-        image: gitea.violin-work.online/registry/maven:3.9-eclipse-temurin-22
-        env:
-          MAVEN_OPTS: "-Dmaven.repo.local=/root/.m2/repository"
-        commands:
-          - mkdir -p /root/.m2/repository
-          - for m in violin-parent violin-common violin-core; do
-              echo "--- installing $m ---";
-              mvn -B -f "$m/pom.xml" clean install -DskipTests;
-            done
-          - mvn -B -f violin-iam/pom.xml verify
-
-      # Step 2: build image via kaniko and push to the violin registry.
-      # Mirrors the `drone-kaniko` plugin used by .drone.yml. Only runs on
-      # pushes to main (PR branches just want the test gate).
-      - name: Build and push image
-        if: gitea.ref == 'refs/heads/main'
-        image: gitea.violin-work.online/registry/drone-kaniko:latest
-        settings:
-          repo: gitea.violin-work.online/violin/violin-iam
-          tags:
-            - latest
-            - ${GITEA_SHA:0:8}
-          dockerfile: Dockerfile
-          context: .
-          registry: gitea.violin-work.online
-          username: simple321vip
-          password:
-            from_secret: docker_password
-
-      # Step 3: roll the deployment. Only after main-branch image push.
-      - name: Deploy to violin namespace
-        if: gitea.ref == 'refs/heads/main'
-        image: gitea.violin-work.online/registry/kubectl:latest
-        commands:
-          - kubectl set image deployment/violin-iam violin-iam=gitea.violin-work.online/violin/violin-iam:${GITEA_SHA:0:8} -n violin

AGENTS.md

@@ -67,8 +67,6 @@ context. Concrete gotchas to fix:
 
 ## Design notes (do not skip)
 
-## Design notes (do not skip)
-
 ### JWT revocation propagation — what we tried, what we picked, and why
 
 The naive question "should we drop `customerId` from the JWT claim so
@@ -76,6 +74,7 @@ downstream must call IAM every request?" was the wrong frame. Below is
 the actual decision tree we walked.
 
 #### Problem
+
 A user's `t_user.customer_id` is migrated from tenant A to tenant B. The
 JWT issued at login still carries `customerId=A`. Without propagation
 the user keeps operating under A's RBAC scope (and SAR cache) for the
@@ -146,4 +145,3 @@ push `(sub, oldCustomerId)` into it. Have `PermissionAspect` consult the cache
 as a secondary check (after verified gate). Reduce default `expirationMs`
 in `ViolinJwtProperties` from `86_400_000` (24 h) to `3_600_000` (1 h).
 These three together close the revocation window to the bound of TTL.
-

example/configmap-dev-template.yaml

@@ -0,0 +1,28 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: dev
+data:
+  SPRING_PROFILES_ACTIVE: "dev"
+
+  DB_HOST: "violin-postgres-dev"
+  DB_PORT: "5432"
+  DB_NAME: "violin_dev"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://dev.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://dev.violin-home.cn,https://*.violin-work.online,http://localhost:5173"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"

example/configmap-prod-template.yaml

@@ -0,0 +1,36 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth 生产环境（非敏感配置）
+# ============================================================
+# 使用方式：
+#   kubectl apply -f example/configmap-template.yaml
+#
+# 说明：
+#   - 非敏感参数放这里，可 commit 进 Git
+#   - 敏感凭据（密码 / secret）走 secret-template.yaml，绝不 commit 真实值
+#   - KubeSphere UI 可直接导入此文件
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: production
+data:
+  SPRING_PROFILES_ACTIVE: "prod"
+
+  DB_HOST: "violin-postgres"
+  DB_PORT: "5432"
+  DB_NAME: "violin"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://www.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://www.violin-home.cn,https://*.violin-work.online"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"

example/secret-dev-template.yaml

@@ -0,0 +1,27 @@
+# ============================================================
+# Secret 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+# ⚠️ 真实凭据通过 KubeSphere UI 或 CI/CD 注入，不要 commit 真实值
+# dev 环境凭据可以和 prod 区分开（推荐），也可以共用（不推荐）
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: dev
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_DEV_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_DEV_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC（dev application）----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_SECRET"

example/secret-prod-template.yaml

@@ -0,0 +1,30 @@
+# ============================================================
+# Secret 模板 — violin-auth 生产环境（敏感凭据）
+# ============================================================
+# ⚠️  重要：
+#   - 本文件是 TEMPLATE，真实凭据值必须通过以下方式注入：
+#     1. KubeSphere 控制台 → 配置存储 → Secret → 创建（界面填写真实值）
+#     2. 或 CI/CD 流水线中通过 Drone Secret / sealed-secrets 动态注入
+#   - 绝不要把 stringData 里的占位符替换成真实值后 commit
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: production
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC ----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_AUTHENTIK_CLIENT_SECRET"

pom.xml

@@ -7,11 +7,11 @@
     <parent>
         <groupId>cn.violin</groupId>
         <artifactId>violin-parent</artifactId>
-        <version>2.1</version>
+        <version>2.2</version>
     </parent>
 
     <artifactId>violin-iam</artifactId>
-    <version>2.1</version>
+    <version>2.2</version>
     <name>violin-iam</name>
     <description>violin IAM service</description>
 
@@ -19,7 +19,7 @@
         <dependency>
             <groupId>cn.violin</groupId>
             <artifactId>violin-core</artifactId>
-            <version>2.1</version>
+            <version>2.2.1-SNAPSHOT</version>
         </dependency>
 
         <dependency>

src/main/resources/application.yml

@@ -31,24 +31,24 @@ violin:
   auth:
     exclude-paths: /error
     anonymous-message-code: AUTHORIZATION_MISSING
-iam:
-  service-id: ${VIOLIN_IAM_SERVICE_ID:violin-caller}
-  url: ${VIOLIN_IAM_URL:http://localhost:8080}
-  context-path: ${VIOLIN_IAM_CONTEXT_PATH:/violin-iam}
-  service-token-secret: ${VIOLIN_IAM_SERVICE_TOKEN_SECRET:}
-  service-allowlist: ${VIOLIN_IAM_SERVICE_ALLOWLIST:}
-  profile: ${SPRING_PROFILES_ACTIVE:local}
-  oidc:
-    client:
-      issuer: ${IAM_OIDC_CLIENT_ISSUER:${AUTHENTIK_ISSUER:}}
-      client-id: ${IAM_OIDC_CLIENT_CLIENT_ID:${AUTHENTIK_CLIENT_ID:}}
-      client-secret: ${IAM_OIDC_CLIENT_CLIENT_SECRET:${AUTHENTIK_CLIENT_SECRET:}}
-      redirect-uri: ${IAM_OIDC_CLIENT_REDIRECT_URI:${AUTHENTIK_REDIRECT_URI:}}
-      scope: ${IAM_OIDC_CLIENT_SCOPE:${AUTHENTIK_SCOPE:openid profile email}}
-    authentik:
-      token-endpoint: ${IAM_OIDC_AUTHENTIK_TOKEN_ENDPOINT:}
-      userinfo-endpoint: ${IAM_OIDC_AUTHENTIK_USERINFO_ENDPOINT:}
-      authorize-endpoint: ${IAM_OIDC_AUTHENTIK_AUTHORIZE_ENDPOINT:}
+  iam:
+    service-id: ${VIOLIN_IAM_SERVICE_ID:violin-caller}
+    url: ${VIOLIN_IAM_URL:http://localhost:8080}
+    context-path: ${VIOLIN_IAM_CONTEXT_PATH:/violin-iam}
+    service-token-secret: ${VIOLIN_IAM_SERVICE_TOKEN_SECRET:}
+    service-allowlist: ${VIOLIN_IAM_SERVICE_ALLOWLIST:}
+    profile: ${SPRING_PROFILES_ACTIVE:local}
+    oidc:
+      client:
+        issuer: ${IAM_OIDC_CLIENT_ISSUER:${AUTHENTIK_ISSUER:}}
+        client-id: ${IAM_OIDC_CLIENT_CLIENT_ID:${AUTHENTIK_CLIENT_ID:}}
+        client-secret: ${IAM_OIDC_CLIENT_CLIENT_SECRET:${AUTHENTIK_CLIENT_SECRET:}}
+        redirect-uri: ${IAM_OIDC_CLIENT_REDIRECT_URI:${AUTHENTIK_REDIRECT_URI:}}
+        scope: ${IAM_OIDC_CLIENT_SCOPE:${AUTHENTIK_SCOPE:openid profile email}}
+      authentik:
+        token-endpoint: ${IAM_OIDC_AUTHENTIK_TOKEN_ENDPOINT:}
+        userinfo-endpoint: ${IAM_OIDC_AUTHENTIK_USERINFO_ENDPOINT:}
+        authorize-endpoint: ${IAM_OIDC_AUTHENTIK_AUTHORIZE_ENDPOINT:}
 
 management:
   endpoints: